Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=55967
Fixes a regression introduced by commit efd03f40e6e315d89cd1d09c48180aae82033f9f.
The app reads syscall thunk for NtQueryInformationProcess() from ntdll file and just calls that from some memory location. That worked before the referenced commit because without performing relocations that was jumping to wine_syscall in the loaded ntdll.dll. Now when the actual ntdll load address is different that jumps to the same address which is now non sensual.
The existing tests show that in general 32-bit syscall thunks need relocation. The same trick with some other Nt functions I tried doesn't work on Windows, but turns out NtQueryInformationProcess is special (the included test replicates that). The form of syscall thunk I used in the patch corresponds to what was in Wine-Staging before the upsream implementation of syscall thunks (that is, call to NtCurrentTeb()->WOW32Reserved).